针对当前加密流量识别研究中因神经网络架构导致特征信息提取不充分的问题,本文提出了一种基于注意力的多特征融合加密流量识别方法。所提方法聚焦于加密流量的层次结构特点,设计了两个并行的网络分支进行特征提取,分支一采用残差神经网络(Residual Neural Network, ResNet)提取流量的原始特征,分支二利用不规则大小卷积核组成的Inception-CNN(Convolutional Neural Networks)提取流的统计特征进行表征以补偿流量裁剪带来的信息损失。此外,本文将统计特征由现有的灰度图转换成RGBA图像的形式作为输入来帮助模型更有效地提取特征。两个分支提取到的特征被合并为新的特征向量输入到通道注意力模块中进行加权,以增强流量特征的表征能力。实验结果表明,该模型较现有典型的加密流量分类方法具有更好的表现,精度、召回率和F1-score均有明显提高,其中综合性能指标F1-score较现有方法平均提高了6%。
To address the issue of insufficient feature information extraction caused by neural network architecture in current encrypted traffic recognition research, this paper proposes a multi-feature fusion encrypted traffic recognition method based on attention mechanism. The proposed method focuses on the hierarchical structure characteristics of encrypted traffic and designs two parallel network branches for feature extraction. Branch one uses residual neural network(ResNet) to extract the original features of traffic, while branch two uses an Inception-CNN composed of irregular-sized convolution kernels to extract statistical features of traffic for characterization and compensate for the information loss caused by traffic cropping. In addition, this paper converts the statistical features from the existing grayscale image to the RGBA image format as input to help the model more effectively extract features. The features extracted by the two branches are merged into a new feature vector and input into the channel attention module for weighting to enhance the representation ability of traffic features. The experimental results show that the proposed model performs better than existing typical encrypted traffic classification methods, with significantly improved accuracy, recall rate, and F1-score, among which the comprehensive performance metric F1-score is increased by an average of 6% compared to existing methods.